feat: add redacted structured tracing

[oratis]

Summary

• generate one host-owned trace id per turn and attach it to durable and transient protocol events
• write bounded, mode-0600 app-server NDJSON using a strict metadata allowlist instead of protocol payload serialization
• add capability-negotiated diagnostics/export and deepcode diagnostics export with path hashing and second-pass log sanitization
• keep observability best-effort so a broken trace sink cannot alter protocol or execution behavior
• embed the settings schema in CJS sidecars so packaged Desktop and VS Code runtimes start without import.meta.url failures
• document storage, privacy, compatibility, and rollback behavior

Validation

• pnpm format:check
• pnpm lint (one pre-existing warning)
• pnpm typecheck
• pnpm test (1001 passed, 12 skipped)
• pnpm docs:check
• pnpm build
• pnpm --filter @deepcode/desktop test:e2e (4 passed)
• sidecar and VS Code app-server CJS syntax + live initialize/export smoke
• VSIX: 8 files, 173.86 KB

Security checks

• adversarial extra prompt/command/header/tool payload fields are not persisted
• diagnostic export re-sanitizes tampered log records
• raw workspace and configuration paths are absent from support bundles
• logs and bundles are created with mode 0600

[oratis]

Review: approved ✅

Tracing is a classic way to leak everything the rest of a stack protects, and this one is built to avoid that.

What I checked

• Strict metadata allowlist instead of serializing protocol payloads. Allowlist, not denylist — the only design that stays safe as the protocol grows. A denylist would silently start logging every field added in a later PR.
• Mode 0600, bounded NDJSON. Correct permissions for a file that will contain operational metadata, and bounded so a long session can't fill the disk.
• Path hashing plus a second-pass sanitization on export. Defence in depth: paths leak project structure and sometimes usernames, and the second pass covers anything the allowlist let through by accident.
• Best-effort observability — a broken trace sink cannot alter protocol or execution behavior. This is the invariant I most wanted. Telemetry that can fail a turn is worse than no telemetry, and it's the failure mode that produces "the app broke because logging broke" incidents.
• One host-owned trace id per turn attached to both durable and transient events, so a report can be correlated across clients without the client minting ids.

Separate but valuable: embedding the settings schema in the CJS sidecars fixes packaged Desktop and VS Code runtimes failing on import.meta.url. That's a genuine crash-on-start bug in packaged builds that local ESM dev never reproduces — exactly the class #208's real-artifact gates exist to catch.

Validation: CI green; full suite green locally at the stack tip.